Optimal cloning of unitary transformations 
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After proving a general no-cloning theorem for black boxes, we derive the optimal universal cloning 
of unitary transformations, from one to two copies. The optimal doner is realized by quantum chan- 
nels with memory, and greately outperforms the optimal measure-and-reprepare cloning strategy. 
Applications are outlined, including two-way quantum cryptographic protocols. 
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The no-cloning theorem [l| is one of the cornerstones 
of Quantum Information, at the basis of the security of 
quantum cryptography [2j, and challenging various proto- 
cols, from optimal estimation to error correction. Despite 
the long-dated attention to cloning of quantum states, 
cloning of quantum transformations is still a completely 
unexplored topic. Cloning a transformation T means ex- 
ploiting a single use of T inside a quantum circuit, which 
thus performs the transformation T ® T on bipartite 
states. This elementary copying task is particularly rel- 
evant to the recent trend in Quantum Information, with 
the role of the information carrier played more and more 
by transformations instead of states, e. g. in gate dis- 
crimination [3], Ijl programming |5j, teleportation[6|,|7|,|8(, 
and tomography [15l . 1X61 ] , along with multi-round games 
[9( and cryptographic protocols like bit commitment with 
anonymous-state encoding [lOJ, LL1| • Here cloning is the 
great absent of the list, partly due to the intrinsic dif- 
ficulty in treating manipulations of transformations in- 
stead of states. Such a difficulty has been overcome by 
the method of Ref. [12j, which allows one to optimize 
tasks where the input and output are transformations. 

Cloning quantum transformations can be used for 
copying quantum software with a limited number of uses, 
and in other informational contexts. An interesting ap- 
plication is in the security analysis of multi-round cryp- 
tographic protocols with encoding on secret transforma- 
tions. Consider, for example, the following alternative 
version of the BB84 cryptographic protocol [13j, where 
Alice uses two orthogonal bases of unitary transforma- 
tions instead of states, B\ = {a^} and B 2 = {C/cr M }, 
where fj, = 0, 1, 2, 3, o~o is the identity, 0X2,3 are the three 
Pauli matrices, and U = (I + i 2fc=i °fc)/2 is a rotation 
of 2tt/3 around the axis n = (l,l,l)/\/3. The proto- 
col works as follows: Bob prepares an arbitrary maxi- 
mally entangled state \B) of two qubits and sends half 
of it to Alice, who applies one of the unitaries and sends 
the output to Bob, as in dense coding 14|. Afterwards, 
Bob measures the two qubits either on the Bell basis 
{(o> ® I)\B)} or on the rotated basis {(E/er M ® I)\B)}, 
which are mutually unbiased for any maximally entan- 
gled state \B). After publicly announcing their choice of 
bases, and discarding cases where the bases were differ- 



ent, Alice and Bob use the values of index fi to establish a 
secret key. In this protocol, a naive eavesdropping strat- 
egy would be for Eve trying to estimate the unitaries, by 
swapping the qubit sent by Bob with a qubit prepared by 
her — e.g. in a known maximally entangled state \E), half 
of which she keeps for herself — , and then intercepting the 
qubit sent back by Alice. To prevent this attack Alice can 
randomly ask Bob to send his half of the entangled state, 
and to later reveal \B), so that she can check whether the 
received state was actually from Bob. However, Eve can 
perform coherent attacks that are much more efficient 
than naive estimation. Among coherent attacks, the first 
and most natural to investigate is quantum cloning. 

Differently from pure states, cloning of transformations 
is impossible even classically. This is a consequence of a 
general no-cloning theorem, holding not only for states, 
but also for transformations and any other kind of black 
boxes (e.g. measuring devices). Denoting by p the mini- 
mum of the worst case error probability in discriminating 
between two black boxes 0\ and 02, we have the follow- 
ing theorem, containing as a special case the no-cloning 
of quantum states [l| : two black boxes cannot be perfectly 
cloned by a single use unless p — (perfect discrimi- 
nation) or p — 1/2 (random guess, no discrimination at 
all). The proof is simple: If perfect cloning is possible, we 
can get three copies, perform three times the minimum 
error discrimination, and use majority voting to decide 
the most likely between 0\ and O2 with worst case error 
probability p' = p 2 (3 — 2p) . Since p is the minimum error 
probability, it must be p < p' , whose acceptable solu- 
tions are only p = and p = 1/2 [l7j. Application of the 
theorem to many black boxes {0»}i=i .,k yields the fol- 
lowing cloning-discrimination equivalence: if for any i, j 
the error probability pij is not 1/2, then perfect cloning 
is possible iff perfect discrimination is possible [l8|. As 
a consequence, classical transformations, e.g. permuta- 
tions of a classical register, cannot be cloned by a single 
use (there is no way to discriminate arbitrary permu- 
tations of the letters {a, 6, c} by evaluation on a single 
letter). Likewise, quantum transformations, e.g. unitary 
gates, cannot be cloned by a single use (there is no way 
to discriminate arbitrary gates by a single use [3j). 

The existence of a no-cloning theorem immediately 
rises the question about the performances of optimal 



doners. In addition to possible cryptographic applica- 
tions, the problem has a fundamental interest in itself, 
as the relation (if any) between optimal cloning of trans- 
formations and cloning of states is not a priori obvious. 
In this Letter we derive the optimal universal doner, 
which produces two approximate copies of a completely 
unknown unitary gate in dimension d < oo, show- 
ing that entanglement with a quantum memory allows 
one to outperform any classical cloning strategy. For 
qubits the global channel fidelity of the clones is F c i on = 
46.65%, significantly larger than the fidelity of the opti- 
mal measure-and-prepare scheme F est — 31%, and of the 
random guess (using the given unitary on the first sys- 
tem, and performing a random unitary on the second) 
F ran — 25%. Surprisingly, cloning of unitary gates has 
no relation with cloning of maximally entangled states, 
in spite of the two sets being commonly considered as 
equivalent. Not only cloning maximally entangled states 
is always a suboptimal step for cloning unitary gates, 
but also any other scheme involving application of the 
unknown gate to a maximally entangled state (or any 
other fixed state) is necessarily suboptimal. As it will 
be shown, this also highlights a fundamental difference 
between the two tasks of cloning and learning quantum 
transformations. 
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FIG. 1: a) One-to-two cloning of unitaries. Two input sys- 
tems are first processed by Eve with channel A, which entan- 
gles system 1 and a quantum memory M . While the memory 
M is kept by Eve, system 1 is sent to Alice, who applies the 
secret gate hi, and sends back output 2. Then, Eve applies the 
channel B, producing two output systems, so that the over- 
all transformation from inputs to outputs optimally emulates 
U® 2 . b) One-to-two quantum learning of unitary. In a train- 
ing phase, the example U is applied locally on the bipartite 
state o, and stored in the state au = (U®I)cr(U^ <8> J). Then, 
two input systems interact with ou , undergoing a transforma- 
tion that optimally emulates VI®' 1 . 



The derivation of the optimal doner exploits the recent 
toolbox of quantum circuit architecture theory [T2J , which 
allows optimization of quantum networks for any possi- 
ble manipulation of quantum channels, including cloning 
and estimation. In this framework any channel C from 
SiTiin) to S(H ut) [<5(W) denoting states on H] is de- 
scribed by its Choi operator C = C <E> T(\I)(I\), where 
\I) = X)i=i I*) I*) is an unnormalized maximally entangled 
vector in Tim^Tim- For a unitary channel U{p) = UpW , 
the Choi operator is \U)(U\, with \U) = (U <g> I)\I). A 
quantum network for N-to-M cloning is a network with 
N open slots in which the N input copies are inserted, 



and is also described by a suitable Choi operator R( N ^ 
(N = 1 for one-to-two cloning, sec Fig. [T]). If the Hilbcrt 
spaces of the inputs are labeled with even numbers from 

to 2N, and the output spaces with odd numbers from 

1 to 2 A + 1, the Choi operator R( N *> is a non- negative 
operator on the tensor product <^) fe _ 'rik satifsying the 
recursive normalization condition 
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RW =/ 2 iV®i? (W - 1) , 



(1) 



where Tj^jv+i denotes the partial trace over the Hilbcrt 
space TC2N+1 of the N + 1-th output system, and i?^ -1 ) 
is the Choi operator of a network with N — 1 open slots, 
which in turn satisfies Eq. |T]) with N replaced by N — 1 . 
A network with A = open slots is a quantum chan- 
nel from S(7io) to S(Hi), and has the normalization 
Tri[i?(°)] = I . Inserting A channels C x , . . . ,C N in the 
N slots of a network, we obtain a new channel C' from 
S(Hq) to S(H.2N+i), with Choi operator given by [13 | 



C" = Tr lj2i ... j 2iv[(io®C? 



>C* N ®I 2N+1 )RW] . (2) 



In one-to-two cloning (N = 1) the first input TCo and 
the last output H.3 must have a bipartite structure, H.q = 
'Hob'&'Hoe and H3 = H-zb 'Si'Hze , since the ultimate aim 
of the network is to mimick the bipartite channel Ub ®Ue 
on Bob's and Eve's systems. Then, the normalization of 
the Choi operator in Eq. (Q} gives 



Tr 3 [i? (1) ]=/ 2 ®i? (0) , Tn^ )] = 7 



(3) 



Inserting the gate hi in the network, we obtain the bipar- 
tite channel C'y, which according to Eq. @ is given by 
C' v = Tr li2 [(/ <8> |E/*)(E/*|i,2 ® h)R^\. 

We derive now the cloning network for which the chan- 
nel C'u most closely resembles Ub ® Ue ■ As a figure of 
merit we use the global channel fidelity, uniformly aver- 
aged over the unknown unitaries 
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Note that F = 1 if and only if C v = U® 2 for any U, 
corresponding to perfect cloning. Exploiting symmetry 
then provides a radical simplification of the problem: 

Lemma 1 The optimal cloning network maximizing the 
channel fidelity Bl) can be assumed without loss of gen- 
erality to be covariant, i.e. with a Choi operator R^ 1 ' 
satisfiying the commutation relation 
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VV, W g SU(d) . (5) 



Proof. Let R^ be optimal. Then take its average 
flW = J d V J d W V o 02 <g> V x * <g> W 2 * <g> Wf 2 (R^), where 
V, V*,yV*,yV are the unitary channels corresponding to 



V, V*,W*, W. It is immediate to see that i?W statisfies 
Eqs. j5]) and ([3|), and has the same fidelity as R^\ ■ 

The representation V® 2 ®V* in Eq. © can be decom- 
posed into irreducible blocks as follows. First, one has 
V® 2 = V+ © y_, where V± is the irreducible block act- 
ing in symmetric (antisimmctric) subspace 7i± C 7i® 2 , 
of dimension d± = d(<i± l)/2. Then, one can further de- 
compose V + ®V* = V a , + (BVp t+ , where V^, !+ (V^ i+ ) is the 
irreducible block acting on the subspace H a ,+ (H{3,+) C 
7i+ <E> TL, of dimension d a ~ d (dp = d(d+ — 1)). Sim- 
ilarly, V- ® V* = V Q ,_ Vy,—, corresponding to irre- 
ducible subspaces TL a ,- 1 'H 1 - C H- ® H of dimensions 
d a = d,d 1 = d(d- — 1), respectively. Note that the sub- 
spaces 7i Q ,+ and 7i a ,- carry equivalent representations, 
and that for qubits the block H 7 - does not show up. By 
Schur lemmas, the Choi operator R^ 1 ' in Eq. (JSJ must 
be of the form #« = V s £ 
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where S = {a,/?, 7}, r^T-j is a non-negative matrix for 



any p,, v, and 7$ = J2r 



)(/j,,j,n\ is the isomor- 



phism between the two equivalent subspaces TL^i and 
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Tl_ = Tl + = 0). Exploiting this 
fact, we obtain for the fidelity the following expression 
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while the normalization constraint of Eq. ([3]) becomes 

]r d^c = d t d tr -.= J2 *%,«, * = ± ■ (7) 

We are now ready to derive the optimal doner: 

Theorem 1 The fidelity of the optimal universal cloning 
of unitary transformations is F c i on = (d + V ' d 2 — l)/d 3 . 
The value F c i on is achieved by a network as in Fig. [lb 
with pre-processing channel A from S(7ioB ® Ti-OE) to 
S{TLqa ® M), -M being a memory gubit, given by 

A(p)= Y, ^ QE [P lP P 3 }<E>\t)(j\ (8) 

(P± orthogonal projector on TL±, and {|+),||— )} or- 
thonormal basis for M.), and post-processing channel B 
from S(Hob ® M) to S(Hzb ® T~Lze), given by 



m = E 



i,j=± V did] 



Pi [(i\a\j) ® I 3E ] Pj 



(9) 



Accordingly, the approximate cloning of U is a channel 
C' v from S{Hqb ® U 0E ) to S{H 3B ® Use): 

C' u {p)=Bo(U®l M )oA{p) 

d 



= E 



i,j=± V ^"J 



^[C/TroB^pP^C/^/jP,- 



(10) 



Proof. For the fidelity we have the following bound: 

2 



f 4E,|Ec 4?^ 
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The first inequality comes from Schwartz inequality ap- 
plied to the non-negative matrix aij = X)« c ^» r ii'fj > the 
second from the definition of tf M (Eq. ([7])), and the third 
from constraint l[7]). Since the maximum in the bound 
is achieved for minimum d M , i.e. for \x = a, we have 
F < l/d 4 (y / ZjT + yfdZ) 2 = P c ; on . To conclude achiev- 
ability, we directly compute the fidelity between C[j (Eq. 
CEO}) and W® 2 , which yields F(C[,,W® 2 ) = F c/o „ VJ7. ■ 

Let us now clearify the meaning of the pre- and post- 
processing channels A and B in the optimal network. 
First, channel A can be extended to a unitary interac- 
tion between the input systems H.qb , 'Hoe and the mem- 
ory M: A{p) = Tr 0E [V(p<S> |0)(0|)Vt], where |0) = 
(|+) + |-))/V2 G M, and V is the controlled-swap 
V = I®\+)(+\ + S®\-}(-\,S\4>)\ip) =\1>)\<f>). Such an 
extension has a very intuitive meaning in terms of quan- 
tum parallelism: for bipartite input \^)be the single- 
system unitary U is made to work on both B and E by 
applying it to the superposition Y$>) b e + SY$>) b e and dis- 
carding E. Less intuitive, and much more intriguing, is 
the meaning of channel B. It is an extension of optimal 
universal cloning of pure states [19( : if system Hob and 
the ancilla M. arc prepared in the state |^)|+), then we 
obtain B{\f){^\ ® |+>(+|) = d/d + [P + (\TP}(i>\®I)P + }, 
which arc indeed two optimal clones of \ip). This means 
that realizing the optimal cloning of unitaries is a harder 
task than realizing the optimal cloning of states: an 
eavesdropper that is able to optimally clone unitaries 
must also be able to optimally clone pure states. This 
suggests that cryptographic protocols based on gates 
(such as the two-way protocol in the introduction) might 
be harder to attack than protocols based on states. 

The performances of the optimal doner crucially de- 
pend on entanglement with the quantum memory Ai: 
Suppose that after channel A the ancillary qubit A4 
decoheres on the basis {|+),| — )}• Then, the ap- 
proximate cloning of U is no longer given by Eq. 
(fTO]) . but rather by its decohered version C'u(p) = 
J2i=±d/d l [Pi{UTT E[PipPi]®I)Pi\- Direct calculation 
of the fidelity in this case gives Fdeco = 1/d 2 , which is 
exactly the same fidelity F ran that one would achieve 
by applying U on the first system and by performing 
a randomly chosen unitary on the second. For large d, 
the optimal fidelity achieved with the quantum memory 
is essentially twice this value. Another classical cloning 
strategy would be to optimally estimate the unknown 
unitary, getting an estimate U, and then performing C/® 2 



on the input systems Hob and Hoe- Using the optimal 
estimation strategy of Ref. [20| we can readily evaluate 
the fidelity of estimation to be F est = 6/d 4 for d > 2, 
Fest = 5/16 for d = 2. Note that, as far as it concerns 
the global fidelity, for d > 2 estimation is by far worse 
than the crude decohered strategy described above. 

We answer now a natural question: since there is a 
canonical isomorphism between unitaries U and maxi- 
mally entangled states \U) = (U ® I)\I), one might won- 
der whether the optimal cloning of U can be achieved 
via cloning of the state \U). Surprisingly at first sight, 
the answer is negative. In order to prove this fact, we 
put ourselves in a slightly more general scenario: we ap- 
ply the unknown gate U to an arbitrary bipartite state 
a € S(P) (not necessarily maximally entangled), and use 
the state au := (U <g> I)a(W <g> I) to program a trans- 
formation Cjj on the two systems Hob, Hoe, given by 
Cu(p) = Tr-p[W(p <g> cny)W^], where W is a suitable in- 
teraction. Again, the goal is to maximize the fidelity 
between L\j and Ub ® Ue- This is an elementary in- 
stance of quantum learning, in which a training set of 
examples — N uses of the unknown IA — is provided in a 
first stage (JV = 1 here), and, after the training has been 
concluded, the learning machine is asked to optimally 
emulate U® M (M = 2 here). Using the same method il- 
lustrated for cloning, we can find the optimal one-to-two 
learning network with Choi operator L' 1 ', for which the 
normalization ([3]) now reads 



Tr 3 [L (i) ] = I 2 ® Pi 



Tr[pi] = 1 



(11) 



where I2 acts on the tripartite space H2 = H-2B ® 
H.2E <£> H2A and the space Ho is one-dimensional (see 
Fig. [I} . Using the symmetry argument of Lemma [TJ we 
can restrict the optimization to Choi operators satisfying 
[L (1) , V{ ® V® B 2 2E ® W* A ® W^s, 3E ] = °> Le - of thc form 
L {2) = E^esEij,*,^ l %S T tj ® T m- The normaliza- 
tion of Eq. (JTT]) then becomes Y^v, m ^im,jm = &ij f° r 
any fj. £ S, and i,j = ±. Maximizing the fidelity un- 
der this constraint we then obtain the maximum value 
Fieam = 6/d 4 for d > 2 and F iearn = 5/d 4 for d = 2, 
exactly the same value of optimal estimation. Therefore, 
any scheme based on the application of U on a fixed 
input state will be extremely poor compared to the op- 
timal doner. This highlights the fundamental difference 
between quantum learning and cloning: in learning one 
has to first apply the unknown gate U to a fixed state a, 
which implies an irreversible degradation of its compu- 
tational power. Note that the difference between cloning 
and learning is a specific treat of quantum channels, while 
for states there is no difference between the two tasks. 
Moreover, one can regard thc quantum learning of uni- 
tary transformations as a special case of gate program- 
ming [5j, e. g. for one-to-two learning thc program is of 
the form a v = {U <g> 1)0(11^ <g> I) and the target is U <g) U. 
In conclusion, in this Letter we proved a general no- 



cloning theorem for black boxes, and derived the optimal 
universal cloning of unitary transformations from one to 
two copies. The optimal doner is realized via a quantum 
channel with memory, and grcately outperforms the op- 
timal measure-and-prepare strategy. Exploring the deep 
relations among cloning, learning, and programming of 
quantum transformations is a natural development of our 
work and an interesting avenue for future research. 
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